This document relates to virtual machines and security services.
A virtual machine is a software-based abstraction of a physical computer system. In general, any computer program that can be executed on a physical computer system can be executed in a virtual machine using virtualization software. Virtualization software is software that is logically interposed and interfaces with a virtual machine and a physical computer system. Each virtual machine is configured to execute an operating system, referred to herein as a guest OS, and applications. A physical computer system, referred to herein as a host machine, can execute one or more virtual machines.
A virtual machine can be accessed locally or remotely, through a network connection. For example, it is possible to use a remote desktop client to access a virtual machine remotely. A remote desktop client is a computer program that communicates user interface information with a remote computer system. Generally, the user interface information includes display data, which is received from the remote computer system and displayed on the computer local to the user, and sends keyboard and mouse inputs generated by the user to the remote computer system. In this way, applications executing remotely from the user can be accessed and interacted with by the user.
Further, applications and operating systems, regardless of executing on a virtual machine or directly on a host machine, are still vulnerable to programs or codes, such as a virus or a worm, that surreptitiously enters a computer environment. Viruses often replicate themselves, or cause themselves to be replicated, thereby consuming excessive amounts of computer resources, and causing degradation or disruption of computer operation. A “worm” can be defined as a virus that automatically attaches itself to outgoing email or other network messages. Some viruses erase or corrupt disk files, or require that a hard disk be entirely reformatted. A virus may wreak its havoc immediately upon entering a computer environment, or may lie dormant until circumstances cause their code to be executed by the host computer. Regardless as to the potential damage that can be caused by a particular virus, all viruses are generally considered malicious, should be prevented from infecting a system, and should be removed if discovered. For present purposes, the term “virus” will refer to any such malicious code.
The threat of viruses is particularly acute in a networked environment, where a computer on the network is accessible to viruses of varying degrees of sophistication and severity created by legions of hackers. These viruses may surreptitiously enter the computer environment through a variety of mechanisms, for example, as attachments to emails or as downloaded files, or through a service program listening to a network port. Various examples of antivirus software include system scanners that scan a complete disk drive and memory system for malicious code, and “on-access” scanners that scan a file when it is requested by the operating system. Other types of antivirus software are possible.